Privacy Policy

This Privacy Policy explains how BookingFlow ("we," "us," or "our") collects, uses, and protects information when you use our booking platform. We believe in transparency, so we've written this in plain English.

1. Information We Collect

1.1 Account Information

When you create a BookingFlow account, we collect:

• Name and email address
• Business/venue name and address
• Phone number (optional)
• Password (encrypted with bcrypt)

1.2 Booking Data

When customers book through your widget, we collect:

• Customer name, email, and phone number
• Booking date, time, and participant count
• Special requests or notes

1.3 Payment Information

We use Stripe to process payments. We never store credit card numbers. Stripe collects payment details securely. We receive transaction metadata (amount, date, last 4 digits) to reconcile bookings.

1.4 Usage Analytics

We collect anonymous usage data to improve the platform:

• Pages viewed and features used
• Browser type and device information
• IP address (for security and regional optimization)
• Time spent on pages

2. How We Use Your Information

We use your data to:

• Provide the service: Process bookings, send confirmations, manage your account
• Improve the product: Analyze usage patterns to build better features
• Communicate: Send important updates, security alerts, and (if you opt in) product announcements
• Security: Detect fraud, prevent abuse, and protect accounts
• Legal compliance: Respond to legal requests and enforce our Terms of Service

3. Data Sharing

3.1 Third-Party Services

We share data with trusted partners who help us run the platform:

• Stripe: Payment processing (see Stripe's Privacy Policy)
• AWS: Infrastructure and hosting (PostgreSQL, SES, CloudFront)
• Analytics providers: Anonymous usage analytics

3.2 What We Don't Do

We do not sell your data to third parties. Period. We do not rent, trade, or monetize your personal information.

3.3 Legal Obligations

We may disclose information if required by law (subpoena, court order) or to protect our rights and users' safety.

4. Cookies and Tracking

We use cookies to keep you logged in and understand how you use BookingFlow. See our Cookie Policy for details.

Types of cookies we use:

• Essential: Authentication and session management (required)
• Analytics: Anonymous usage tracking (can be disabled)
• Preferences: Theme and language settings

5. Data Retention

We keep your data as long as your account is active. When you delete your account:

• Personal data is deleted within 30 days
• Booking records are retained for 7 years (tax and legal compliance)
• Anonymous analytics may be retained indefinitely

6. Your Rights

You have control over your data:

6.1 Access and Export

Request a copy of your data anytime. Email support@bookingflowai.com for a full export (delivered within 30 days).

6.2 Correction

Update your account information in Settings → Profile. For booking data corrections, contact support.

6.3 Deletion

Delete your account in Settings → Account. All personal data is removed within 30 days (booking records archived per legal requirements).

6.4 Objection

You can opt out of marketing emails anytime (click "Unsubscribe"). You cannot opt out of transactional emails (booking confirmations, security alerts).

7. GDPR Compliance (EU Users)

If you're in the European Union:

7.1 Legal Basis

We process your data based on:

• Contract: To provide the service you signed up for
• Legitimate interest: Product improvement, fraud prevention
• Consent: Marketing emails (opt-in)

7.2 Data Controller

BookingFlow (Advisor Media Group) is the data controller for venue owner accounts. For customer booking data, the venue owner is the controller and BookingFlow is the processor. See our Data Processing Agreement.

7.3 Data Protection Officer

Contact our DPO at support@bookingflowai.com with "GDPR Request" in the subject line.

7.4 Right to Lodge a Complaint

You can file a complaint with your local data protection authority if you believe we've mishandled your data.

8. CCPA Compliance (California Users)

If you're a California resident, you have these rights under the California Consumer Privacy Act:

8.1 Right to Know

Request details about the personal information we've collected about you in the past 12 months (categories, sources, purpose, third parties).

8.2 Right to Delete

Request deletion of your personal information (subject to legal retention requirements).

8.3 Right to Opt-Out of Sale

We do not sell personal information. Never have, never will.

8.4 Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

9. Children's Privacy

BookingFlow is not intended for users under 16. We do not knowingly collect data from children. If you're a parent and believe your child has created an account, contact us immediately at support@bookingflowai.com.

10. International Data Transfers

BookingFlow is based in the United States. If you access our service from outside the US, your data may be transferred to and stored on servers in the US. By using BookingFlow, you consent to this transfer.

For EU users, we use Standard Contractual Clauses (SCCs) approved by the European Commission to protect your data during international transfers.

11. Security Measures

We take security seriously:

• Encryption: All data in transit uses TLS/SSL. Passwords are hashed with bcrypt.
• Access controls: Only authorized personnel can access production data.
• Monitoring: We log access and monitor for suspicious activity.
• Regular audits: Security reviews and penetration testing.

No system is 100% secure. If we discover a breach, we'll notify affected users within 72 hours (as required by GDPR).

12. Changes to This Policy

We may update this Privacy Policy occasionally. If we make significant changes, we'll email you 30 days before they take effect. Continued use after changes means you accept the updated policy.

Last updated: February 24, 2026

13. Contact Us

Questions about this Privacy Policy? Contact us: